October 22, 2026 - Content Release

This content release includes:

• Includes new rules and updates to existing rules to detect webshell activity resulting from exploits such as php2shell
• 2 new outlier rules that detect spikes in HTTP 5xx server errors, both from a single source IP and to a single web server, compared against a 30-day baseline. A spike can mean exploitation attempts, fuzzing, a bad deployment, or a denial-of-service condition. These rules only evaluate hosts in the web_servers and/or http_servers match lists, so they will not fire until one of those lists is populated
• Expanded web shell detection: the Suspicious Shells Spawned by Web Servers and Web Services Executing Common Web Shell Commands rules now cover Linux web servers (Apache, Nginx, PHP-FPM, Tomcat) and additional shells, interpreters, and reconnaissance commands (such as id, uname, cat /etc/passwd, and netcat). Matching is now case-insensitive and anchored to the process name, which reduces matches on unrelated processes. Both rules also have expanded descriptions with investigation and tuning guidance
• Fixed the domain controller exclusion for Windows Event ID 4776 (NTLM credential validation) in 7 brute force and password attack rules. Event 4776 has no source IP, so the IP-based domain_controllers match list never excluded these events. The rules now use the hostname-based domain_controller_hostnames match list. Populate that list to suppress 4776 failures logged on your domain controllers
• The Okta parser now extracts usernames whose email domain has a top-level domain longer than three characters (for example, .info or .cloud). These were previously missed
• Changes are enumerated below

Rules

• [New] OUTLIER-S00036 Spike in HTTP Server Errors from Source IP
• [New] OUTLIER-S00037 Spike in HTTP Server Errors to Destination IP
• [Updated] THRESHOLD-S00096 Brute Force Attempt
• [Updated] THRESHOLD-S00103 Domain Brute Force Attempt
• [Updated] THRESHOLD-S00102 Domain Password Attack
• [Updated] THRESHOLD-S00095 Password Attack from Host
• [Updated] THRESHOLD-S00116 Password Attack from IP
• [Updated] OUTLIER-S00001 Spike in Login Failures from a User
• [Updated] CHAIN-S00008 Successful Brute Force
• [Updated] MATCH-S00164 Suspicious Shells Spawned by Web Servers
• [Updated] MATCH-S00174 Web Services Executing Common Web Shell Commands

Parsers

• [Updated] /Parsers/System/Okta/Okta